MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf16aaa4e7e4e906915e9901e93f4de670355784d5350991e8f09b813cc7988d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RecordBreaker


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf16aaa4e7e4e906915e9901e93f4de670355784d5350991e8f09b813cc7988d
SHA3-384 hash: 7cfbb6a8b60e89f79a983daffb3be2d89364e38d47ae17d6cbc4df2fa7760e57972a3ec6f78c924394a6fef8e5b4498d
SHA1 hash: 1efd790a0df3814a0c5cc4d81f31c2ae7e764e2b
MD5 hash: b27fda3b7eba2be512d2a6da23b2281f
humanhash: eight-colorado-video-vermont
File name:b27fda3b7eba2be512d2a6da23b2281f
Download: download sample
Signature RecordBreaker
Create hunting rule
File size:210'432 bytes
First seen:2022-09-09 00:52:07 UTC
Last seen:2022-09-09 02:51:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b99f18fdee2a56d1879b58f035fa58cd (14 x Smoke Loader, 4 x RecordBreaker, 3 x RedLineStealer)
ssdeep 3072:kvM5qvN5ZaKE7xJcQ9uwm7E6u1sqGnbZNOqK2p:ri1aB7lowUEVWqWOqKq
Threatray 360 similar samples on MalwareBazaar
TLSH T17324D011B6D2C431C1E788304475D7A5AA7BB8F16A25888F7BA4377F6E702D033B671A
TrID 40.3% (.EXE) Win64 Executable (generic) (10523/12/4)
19.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
17.2% (.EXE) Win32 Executable (generic) (4505/5/1)
7.7% (.EXE) OS/2 Executable (generic) (2029/13)
7.6% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon c01edecea68c9ccc (15 x RedLineStealer, 13 x Smoke Loader, 5 x Stop)
Reporter zbetcheckin
Tags:32 exe recordbreaker

Intelligence

File Origin
# of uploads :
2
# of downloads :
364
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
raccoon
Create hunting rule
ID:
1
File name:
b27fda3b7eba2be512d2a6da23b2281f
Verdict:
Malicious activity
Analysis date:
2022-09-09 00:52:32 UTC
Tags:
raccoon trojan recordbreaker loader stealer
Link:
https://app.any.run/tasks/86cb4c90-af41-4ff1-98c7-fa1c16d9348c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/308877/
Detection(s):
SecuriteInfo.com.Win32.RansomX-gen.8094.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending an HTTP POST request
Sending an HTTP GET request
Creating a file
Reading critical registry keys
Creating a window
Launching the default Windows debugger (dwwin.exe)
Sending a custom TCP request
Stealing user critical data
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/37125/overview
Behaviour
MalwareBazaar
MeasuringTime
CPUID_Instruction
SystemUptime
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
coinminer greyware packed smokeloader
Link:
https://www.filescan.io/uploads/631a8eebbdec86ddb45dc049/reports/4d70b649-971d-459c-b04a-3a8e59f164eb/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Raccoon Stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ea363ac3-b859-4381-b948-08d11d2a4a4b
Result
Threat name:
Raccoon Stealer v2
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1067507
Signature
C2 URLs / IPs found in malware configuration
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Raccoon Stealer v2
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf16aaa4e7e4e906915e9901e93f4de670355784d5350991e8f09b813cc7988d/
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2022-09-09 00:53:06 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z4lkvjhh4tuqnek6tea6sp2n4zydkv4e2u2qtepi6cnycpghtcgq._file
Verdict:
malicious
Label(s):
raccoon
Create hunting rule
Similar samples:
2b363cc63cf28746e0365b3d25d22e890eec1414ffc4e16e6f078065ab1eb1a2
RecordBreaker
3bf0e1d823e337ba4372bd55bb57d93789bda09c5bf3d8b82a308781c8f9a09f
RecordBreaker
61e9483a13f0e4d906031e1db890424d3f7916710c80ba1d7da968f986fa9764
RecordBreaker
91a4c6f9f3d1a204ab7c7f790e1dbb96c135aff52c6e768ac2c10a24e82919a5
RecordBreaker
a97181ba55b9ba36d21729b745c50836f1fe58007a4508511b1161a6d796b754
RecordBreaker
eb6b1b9f09b85071216997ab608a8fa3fe45e7f8840dec8417a17133140a9ac5
RecordBreaker
f6b30a3195b740a4dd8464d29bfb7bdbd860bbfd48a5a3e4b7c9a655d5d5fd3c
RecordBreaker
+ 350 additional samples on MalwareBazaar
Result
Malware family:
raccoon
Create hunting rule
Score:
  10/10
Tags:
family:raccoon botnet:567d5bff28c2a18132d2f88511f07435 discovery spyware stealer
Link:
https://tria.ge/reports/220909-a8mm9sdccm/
Behaviour
Enumerates physical storage devices
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Raccoon
Malware Config
C2 Extraction:
http://116.203.167.5/
http://195.201.248.58/
Unpacked files
SH256 hash:
a6b0212a9d82a6eaffcc7da8d53b0190c668e1aab7e1aa669280bc7b9c9340ba
MD5 hash:
0299baa991972658bed068fcce759338
SHA1 hash:
31b911f731ab3dd3ae9ed98e19ef5b06ed9a19a0
Detections:
raccoonstealer
Create hunting rule
win_recordbreaker_auto
Create hunting rule
Link:
https://www.unpac.me/results/4e099d5a-5371-4bce-89d8-1db2062cc9e1/
Parent samples :
61e9483a13f0e4d906031e1db890424d3f7916710c80ba1d7da968f986fa9764
cf16aaa4e7e4e906915e9901e93f4de670355784d5350991e8f09b813cc7988d
8324f3a58dbe3ba8a2e06f1fe56de5f0b195da302dd131e01fd51f7f6b77f635
a027bc1335ac781074822ce6092e3241a1177aafc27d14858677a4c7116a2c5f
8efaf5bcb4dd8909f6f923c1e59c126455c2ba722f6787e32db34eba7a87caf3
8a40814ff8c008d254cceccca174641b028284e498c20bfb5156dfeca935c10d
d9cc12873944b748796cf9c8c9bda46d0ae9eee43ac5b230b87600259ab9dc36
8c79af93b3497029228253bdf1f55696e07a24b9dba5adbc976764dcd18e78aa
570c8bfbfe83183e8cf87d989d2a0bee76da03f0db2061578629d3939a4a42f7
1fd4bf30406763ce63b8b0840f683f54d23ff876c6c8ed18ad11bd07eef743c4
3dd554251ff82ea8e869a7b847623ea9faccbd9b99729ae298b2b76689641f41
cd7859e032cef757f88cc77006b3e0ba62514416eb279ff6e4978ebe157a5f9e
2e7fea68efd35999000bfa905124a0edd6f9c8db04017133ec62cddce9b787c4
SH256 hash:
cf16aaa4e7e4e906915e9901e93f4de670355784d5350991e8f09b813cc7988d
MD5 hash:
b27fda3b7eba2be512d2a6da23b2281f
SHA1 hash:
1efd790a0df3814a0c5cc4d81f31c2ae7e764e2b
Link:
https://www.unpac.me/results/4e099d5a-5371-4bce-89d8-1db2062cc9e1/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cf16aaa4e7e4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cf16aaa4e7e4e906915e9901e93f4de670355784d5350991e8f09b813cc7988d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:RaccoonV2
Create hunting rule
Author:@_FirehaK <yara@firehak.com>
Description:This rule detects Raccoon Stealer version 2.0 (called Recordbreaker before attribution). It has been spotted spreading through fake software cracks and keygens as far back as April 2022.
Reference:https://www.zerofox.com/blog/brief-raccoon-stealer-version-2-0/
Rule name:win_recordbreaker_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.recordbreaker.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

RecordBreaker

Executable exe cf16aaa4e7e4e906915e9901e93f4de670355784d5350991e8f09b813cc7988d

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/308877/
  
URLhaus
https://urlhaus.abuse.ch/url/2297282/

Comments


Avatar
zbet commented on 2022-09-09 00:52:09 UTC

url : hxxp://85.192.63.184/m.exe